1 files changed, 170 insertions, 0 deletions

diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2017-9955_8.patch b/meta/recipes-devtools/binutils/binutils/CVE-2017-9955_8.patch
new file mode 100644
index 0000000000..8035ab38cb
--- /dev/null
+++ b/meta/recipes-devtools/binutils/binutils/CVE-2017-9955_8.patch
@@ -0,0 +1,170 @@
+commit bae7501e87ab614115d9d3213b4dd18d96e604db
+Author: Alan Modra <amodra@gmail.com>
+Date:   Sat Jul 1 21:58:10 2017 +0930
+
+    Use bfd_malloc_and_get_section
+    
+    It's nicer than xmalloc followed by bfd_get_section_contents, since
+    xmalloc exits on failure and needs a check that its size_t arg doesn't
+    lose high bits when converted from bfd_size_type.
+    
+        PR binutils/21665
+        * objdump.c (strtab): Make var a bfd_byte*.
+        (disassemble_section): Don't limit malloc size.  Instead, use
+        bfd_malloc_and_get_section.
+        (read_section_stabs): Use bfd_malloc_and_get_section.  Return
+        bfd_byte*.
+        (find_stabs_section): Remove now unnecessary cast.
+        * objcopy.c (copy_object): Use bfd_malloc_and_get_section.  Free
+        contents on error return.
+        * nlmconv.c (copy_sections): Use bfd_malloc_and_get_section.
+
+Upstream-Status: Backport
+
+CVE: CVE-2017-9955
+Signed-off-by: Thiruvadi Rajaraman <trajaraman@mvista.com>
+
+Index: git/binutils/nlmconv.c
+===================================================================
+--- git.orig/binutils/nlmconv.c 2017-09-21 18:14:15.792797232 +0530
++++ git/binutils/nlmconv.c      2017-09-21 18:14:15.776797105 +0530
+@@ -1224,7 +1224,7 @@
+   const char *inname;
+   asection *outsec;
+   bfd_size_type size;
+-  void *contents;
++  bfd_byte *contents;
+   long reloc_size;
+   bfd_byte buf[4];
+   bfd_size_type add;
+@@ -1240,9 +1240,7 @@
+     contents = NULL;
+   else
+     {
+-      contents = xmalloc (size);
+-      if (! bfd_get_section_contents (inbfd, insec, contents,
+-                                     (file_ptr) 0, size))
++      if (!bfd_malloc_and_get_section (inbfd, insec, &contents))
+        bfd_fatal (bfd_get_filename (inbfd));
+     }
+ 
+Index: git/binutils/objdump.c
+===================================================================
+--- git.orig/binutils/objdump.c 2017-09-21 18:14:15.792797232 +0530
++++ git/binutils/objdump.c      2017-09-21 18:23:30.420895459 +0530
+@@ -180,7 +180,7 @@
+ static bfd_byte *stabs;
+ static bfd_size_type stab_size;
+ 
+-static char *strtab;
++static bfd_byte *strtab;
+ static bfd_size_type stabstr_size;
+ 
+ static bfd_boolean is_relocatable = FALSE;
+@@ -2037,33 +2037,13 @@
+     }
+   rel_ppend = rel_pp + rel_count;
+ 
+-  /* PR 21665: Check for overlarge datasizes.
+-     Note - we used to check for "datasize > bfd_get_file_size (abfd)" but
+-     this fails when using compressed sections or compressed file formats
+-     (eg MMO, tekhex).
+-
+-     The call to xmalloc below will fail if too much memory is requested,
+-     which will catch the problem in the normal use case.  But if a memory
+-     checker is in use, eg valgrind or sanitize, then an exception will
+-     be still generated, so we try to catch the problem first.
+-
+-     Unfortunately there is no simple way to determine how much memory can
+-     be allocated by calling xmalloc.  So instead we use a simple, arbitrary
+-     limit of 2Gb.  Hopefully this should be enough for most users.  If
+-     someone does start trying to disassemble sections larger then 2Gb in
+-     size they will doubtless complain and we can increase the limit.  */
+-#define MAX_XMALLOC (1024 * 1024 * 1024 * 2UL) /* 2Gb */
+-  if (datasize > MAX_XMALLOC)
++  if (!bfd_malloc_and_get_section (abfd, section, &data))
+     {
+-      non_fatal (_("Reading section %s failed because it is too big (%#lx)"),
+-                section->name, (unsigned long) datasize);
++      non_fatal (_("Reading section %s failed because: %s"),
++                section->name, bfd_errmsg (bfd_get_error ()));
+       return;
+     }
+ 
+-  data = (bfd_byte *) xmalloc (datasize);
+-
+-  bfd_get_section_contents (abfd, section, data, 0, datasize);
+-
+   paux->sec = section;
+   pinfo->buffer = data;
+   pinfo->buffer_vma = section->vma;
+@@ -2579,12 +2559,11 @@
+ /* Read ABFD's stabs section STABSECT_NAME, and return a pointer to
+    it.  Return NULL on failure.   */
+ 
+-static char *
++static bfd_byte *
+ read_section_stabs (bfd *abfd, const char *sect_name, bfd_size_type *size_ptr)
+ {
+   asection *stabsect;
+-  bfd_size_type size;
+-  char *contents;
++  bfd_byte *contents;
+ 
+   stabsect = bfd_get_section_by_name (abfd, sect_name);
+   if (stabsect == NULL)
+@@ -2593,10 +2572,7 @@
+       return FALSE;
+     }
+ 
+-  size = bfd_section_size (abfd, stabsect);
+-  contents  = (char *) xmalloc (size);
+-
+-  if (! bfd_get_section_contents (abfd, stabsect, contents, 0, size))
++  if (!bfd_malloc_and_get_section (abfd, stabsect, &contents))
+     {
+       non_fatal (_("reading %s section of %s failed: %s"),
+                 sect_name, bfd_get_filename (abfd),
+@@ -2606,7 +2582,7 @@
+       return NULL;
+     }
+ 
+-  *size_ptr = size;
++  *size_ptr = bfd_section_size (abfd, stabsect);
+ 
+   return contents;
+ }
+@@ -2733,8 +2709,7 @@
+ 
+       if (strtab)
+        {
+-         stabs = (bfd_byte *) read_section_stabs (abfd, section->name,
+-                                                  &stab_size);
++         stabs = read_section_stabs (abfd, section->name, &stab_size);
+          if (stabs)
+            print_section_stabs (abfd, section->name, &sought->string_offset);
+        }
+Index: git/binutils/ChangeLog
+===================================================================
+--- git.orig/binutils/ChangeLog 2017-09-21 18:13:09.052268892 +0530
++++ git/binutils/ChangeLog      2017-09-21 18:25:00.195937741 +0530
+@@ -4,6 +4,19 @@
+        * rddbg.c (read_symbol_stabs_debugging_info): Check for an empty
+        string whilst concatenating symbol names.
+ 
++2017-07-01  Alan Modra  <amodra@gmail.com>
++
++       PR binutils/21665
++       * objdump.c (strtab): Make var a bfd_byte*.
++       (disassemble_section): Don't limit malloc size.  Instead, use
++       bfd_malloc_and_get_section.
++       (read_section_stabs): Use bfd_malloc_and_get_section.  Return
++       bfd_byte*.
++       (find_stabs_section): Remove now unnecessary cast.
++       * objcopy.c (copy_object): Use bfd_malloc_and_get_section.  Free
++       contents on error return.
++       * nlmconv.c (copy_sections): Use bfd_malloc_and_get_section.
++
+ 2017-06-30  Nick Clifton  <nickc@redhat.com>
+ 
+        PR binutils/21665